CVE-2017-5340: Integer Overflow
Fixed bug (Use of uninitialized memory in unserialize()). (CVE-2017-5340)
Other sources
It was found that PHP uses uninitialized memory during calls to unserialize(). The payload supplied to unserialize() may control this uninitialized memory region and thus may be used to trick PHP into operating on faked objects and calling attacker controlled destructor function pointers, effectively allowing arbitrary code execution.
Upstream bug:
https://bugs.php.net/bug.php?id=73832
— Red Hat
Zend/zendhash.c in PHP before 7.0.15 and 7.1.x before 7.1.1 mishandles certain cases that require large array allocations, which allows remote attackers to execute arbitrary code or cause a denial of service (integer overflow, uninitialized memory access, and use of arbitrary destructor function pointers) via crafted serialized data.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.0.15 - Upgrade
Upgrade
redhat/phpto a version that resolves this vulnerability.Fixed in 7.1.1 - Upgrade
Upgrade
PHPto a version that resolves this vulnerability.Fixed in 7.0.15 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.0.15 - Upgrade
Upgrade
phpto a version that resolves this vulnerability.Fixed in 7.1.1
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5340?
CVE-2017-5340 has a high severity rating due to its potential to allow remote code execution and denial of service.
How do I fix CVE-2017-5340?
To fix CVE-2017-5340, upgrade PHP to version 7.0.15 or 7.1.1, depending on your current version.
What versions of PHP are affected by CVE-2017-5340?
CVE-2017-5340 affects PHP versions prior to 7.0.15 and 7.1.x before 7.1.1.
What issues does CVE-2017-5340 lead to?
CVE-2017-5340 can lead to integer overflow, uninitialized memory access, and potential execution of arbitrary code.
Is it safe to use PHP versions below the patched versions for CVE-2017-5340?
Using PHP versions below 7.0.15 or 7.1.1 is not safe due to the vulnerabilities present in those versions.